# Beats **URL:** https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=448 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 449 --- ## [How to add variables like application code, context, environment in Filebeat configuration to distinguish the application logs of different applications](https://discuss.elastic.co/t/how-to-add-variables-like-application-code-context-environment-in-filebeat-configuration-to-distinguish-the-application-logs-of-different-applications/133789)
**Author:** [@mohit214721](https://discuss.elastic.co/u/mohit214721)\ **Replies:** 1\ **Last updated:** [May 30, 2018, 6:23am UTC](https://discuss.elastic.co/t/how-to-add-variables-like-application-code-context-environment-in-filebeat-configuration-to-distinguish-the-application-logs-of-different-applications/133789 "2018-05-30T06:23:32Z")
How to add variables like application code, context, environment in Filebeat configuration to distinguish the application logs of different applications. Also, I want to make such configuration such that one application… --- ## [Parsing metricbeat fields in logsatsh](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 11\ **Last updated:** [May 30, 2018, 4:24am UTC](https://discuss.elastic.co/t/parsing-metricbeat-fields-in-logsatsh/133465 "2018-05-30T04:24:28Z")
Hello, I want to parse/filter the fields in Logstash, which are crated by metricbeat. For example: I want to store system.cpu.total.pct -\> under custom field percentCpu Reason for this change is: I have 90% unix se… --- ## [Filebeat configuration assistance](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352)
**Author:** [@jaysundu](https://discuss.elastic.co/u/jaysundu)\ **Replies:** 2\ **Last updated:** [May 29, 2018, 10:08pm UTC](https://discuss.elastic.co/t/filebeat-configuration-assistance/133352 "2018-05-29T22:08:49Z")
I have the ELK stack installed on a Linux Centos 7 machine and am able to ingest from another Linux machine. But I'm unable to ingest from a Windows 2012 Server. Here is my configuration: on linux, 02-beats-input.conf: … --- ## [Auditbeat not displayiing parameters](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 3\ **Last updated:** [May 29, 2018, 8:55pm UTC](https://discuss.elastic.co/t/auditbeat-not-displayiing-parameters/133748 "2018-05-29T20:55:02Z")
I've setup Auditbeat to report on Docker activity but I don't see the parameters. For example if a user types docker exec auditbeat env, the resulting Auditbeat record just has { "auditd" : { "data": { "op": "exec"... b… --- ## [Unable to start auditbeat on docker](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-docker/132609)
**Author:** [@obudiman](https://discuss.elastic.co/u/obudiman)\ **Replies:** 9\ **Last updated:** [May 29, 2018, 7:40pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-docker/132609 "2018-05-29T19:40:47Z")
Hi, I've been trying to deploy the official auditbeat:6.2.4 container on our centos 7.4 but I'm stuck with the following error log: 2018-05-21T03:53:08.825Z INFO instance/beat.go:468 Home path: \[/usr/share… --- ## [Import index template](https://discuss.elastic.co/t/import-index-template/133563)
**Author:** [@Guido\_van\_Brakel](https://discuss.elastic.co/u/Guido_van_Brakel)\ **Replies:** 4\ **Last updated:** [May 29, 2018, 2:00pm UTC](https://discuss.elastic.co/t/import-index-template/133563 "2018-05-29T14:00:46Z")
Hi, I'm trying to import the filebeat index template on CentOS 7, but I'm getting this error: curl -XPUT 'http://localhost:9200/\_template/filebeat?pretty' -d@filebeat-index-template.json { "error" : "Content-Type hea… --- ## [Limit havesters for logging \*.eml](https://discuss.elastic.co/t/limit-havesters-for-logging-eml/133514)
**Author:** [@nacesprin](https://discuss.elastic.co/u/nacesprin)\ **Replies:** 4\ **Last updated:** [May 29, 2018, 1:09pm UTC](https://discuss.elastic.co/t/limit-havesters-for-logging-eml/133514 "2018-05-29T13:09:18Z")
Hello. I want to scan files from directory /email/\*.eml So, the question is if I will have any problem in the future due to the amount of .eml files in /email/ could it be very big. We know that an .eml file is logged j… --- ## [Error parsing postgresql](https://discuss.elastic.co/t/error-parsing-postgresql/133319)
**Author:** [@pollux](https://discuss.elastic.co/u/pollux)\ **Replies:** 2\ **Last updated:** [May 29, 2018, 11:26am UTC](https://discuss.elastic.co/t/error-parsing-postgresql/133319 "2018-05-29T11:26:32Z")
I setup filebeat on a ubuntu 18.04 server. filebeat from elastic repo, version 6.2.4 here is the /etc/filebeat/filebeat.ymlfile: filebeat.config.modules: # Glob pattern for configuration loading path: ${path.config… --- ## [Filebeat 6.2.2 - Index Template](https://discuss.elastic.co/t/filebeat-6-2-2-index-template/132914)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 4\ **Last updated:** [May 24, 2018, 9:33am UTC](https://discuss.elastic.co/t/filebeat-6-2-2-index-template/132914 "2018-05-24T09:33:47Z")
Hi - Is it possible to create my own index template file as a replacement for the default template which is fields.yml? For example: "filebeat\_template.yml" and then load it from filebeat.yml like this: setup.templat… --- ## [Filebeat monitor via proxy\_url](https://discuss.elastic.co/t/filebeat-monitor-via-proxy-url/133651)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 1\ **Last updated:** [May 29, 2018, 9:50am UTC](https://discuss.elastic.co/t/filebeat-monitor-via-proxy-url/133651 "2018-05-29T09:50:10Z")
Hi All, filebeat version: 6.2.4 According to the filebeat-reference-yml you can set a proxy server to send the monitoring data to elasticsearch. I have setup the config like this. xpack.monitoring: proxy\_url: 'http:… --- ## [Where are Docker metadata?](https://discuss.elastic.co/t/where-are-docker-metadata/133561)
**Author:** [@mimmus](https://discuss.elastic.co/u/mimmus)\ **Replies:** 2\ **Last updated:** [May 29, 2018, 8:45am UTC](https://discuss.elastic.co/t/where-are-docker-metadata/133561 "2018-05-29T08:45:37Z")
I'm using Filebeat in a Docker container to forward logs of every container to a Kafka receiver: filebeat.prospectors: - type: log paths: - '/var/lib/docker/containers/\*/\*.log' json.message\_key: log json.keys… --- ## [Kubernetes - Filebeat stops sending/picking up logs](https://discuss.elastic.co/t/kubernetes-filebeat-stops-sending-picking-up-logs/128578)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 16\ **Last updated:** [May 29, 2018, 7:31am UTC](https://discuss.elastic.co/t/kubernetes-filebeat-stops-sending-picking-up-logs/128578 "2018-05-29T07:31:32Z")
Hi! Running Filebeat 6.2.3 in Kubernetes with filebeat.autodiscover. Here's the filebeat.yml ConfigMap: filebeat.yml: |- filebeat.autodiscover: providers: - type: kubernetes in\_cluster: t… --- ## [Facing issue while installing filebeat 6.2.4](https://discuss.elastic.co/t/facing-issue-while-installing-filebeat-6-2-4/133536)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 10\ **Last updated:** [May 29, 2018, 7:01am UTC](https://discuss.elastic.co/t/facing-issue-while-installing-filebeat-6-2-4/133536 "2018-05-29T07:01:17Z")
While installing filebeat , i am getting below error. Please help. File C:\\Filebeat\\install-service-filebeat.ps1 cannot be loaded. The file C:\\Filebeat\\install-service-filebeat.ps1 is not digitally signed. You cannot r… --- ## [How to parse filebeat access log with vhost?](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102)
**Author:** [@nycterent](https://discuss.elastic.co/u/nycterent)\ **Replies:** 3\ **Last updated:** [May 29, 2018, 6:53am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102 "2018-05-29T06:53:52Z")
hello, is there a simple way to parse virtual host from nginx logs with filebeat? any hints would be appreciated :)\] --- ## [How can I monitoring these things?](https://discuss.elastic.co/t/how-can-i-monitoring-these-things/133441)
**Author:** [@WanLi\_Chen](https://discuss.elastic.co/u/WanLi_Chen)\ **Replies:** 2\ **Last updated:** [May 29, 2018, 1:58am UTC](https://discuss.elastic.co/t/how-can-i-monitoring-these-things/133441 "2018-05-29T01:58:44Z")
Hi \*, I'm new to elastic, I am wondering how can I get charts with es: Hard drive's S.M.A.R.T info ,so I can monitoring hundred disk's temperature... UPS info with snmp output IPMI device, etc the sensors' data thank… --- ## [Metricbeat Elasticsearchmodule](https://discuss.elastic.co/t/metricbeat-elasticsearchmodule/133549)
**Author:** [@Milan\_Todorovic](https://discuss.elastic.co/u/Milan_Todorovic)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 7:59pm UTC](https://discuss.elastic.co/t/metricbeat-elasticsearchmodule/133549 "2018-05-28T19:59:16Z")
Hi, I am running Metricbeat 6.2.3. I included Elasticsearch Module inside of it. Everything is running inside docker container based on: FROM docker.elastic.co/beats/metricbeat:6.2.3 image All my other Modules are s… --- ## [vSphere Beats module - inconsistent usage of host name vs host ID](https://discuss.elastic.co/t/vsphere-beats-module-inconsistent-usage-of-host-name-vs-host-id/133321)
**Author:** [@bogd](https://discuss.elastic.co/u/bogd)\ **Replies:** 3\ **Last updated:** [May 28, 2018, 7:36pm UTC](https://discuss.elastic.co/t/vsphere-beats-module-inconsistent-usage-of-host-name-vs-host-id/133321 "2018-05-28T19:36:41Z")
I have recently installed the vSphere module for Beats. And I noticed a strange inconsistency regarding the "host" fields: In the "host" metricset: vsphere.host.name esx01.lab.example.com In the "virtualmachine" … --- ## [Move filebeat.yml file to another place](https://discuss.elastic.co/t/move-filebeat-yml-file-to-another-place/133568)
**Author:** [@lxknvlk](https://discuss.elastic.co/u/lxknvlk)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 4:19pm UTC](https://discuss.elastic.co/t/move-filebeat-yml-file-to-another-place/133568 "2018-05-28T16:19:36Z")
Hi! How can i move the "filebeat.yml" with all the settings file to another place? I want to put in on an efs drive, so that configuration is loaded from there. Otherwise i need to recreate the launch configuration for… --- ## [Missing data and a lot of warning and errors when logging to ES](https://discuss.elastic.co/t/missing-data-and-a-lot-of-warning-and-errors-when-logging-to-es/133181)
**Author:** [@ilijamt](https://discuss.elastic.co/u/ilijamt)\ **Replies:** 4\ **Last updated:** [May 28, 2018, 3:49pm UTC](https://discuss.elastic.co/t/missing-data-and-a-lot-of-warning-and-errors-when-logging-to-es/133181 "2018-05-28T15:49:59Z")
I have metricbeat 6.2.4 with ES 6.2.4 and my logs are full of Metricbeat: https://pastebin.com/VyXVYRk5 ES: https://pastebin.com/8514Lcz8 And the data is missing and not showing information regarding some of the stati… --- ## [Docker metrics retrieval efficiency](https://discuss.elastic.co/t/docker-metrics-retrieval-efficiency/132578)
**Author:** [@localghost](https://discuss.elastic.co/u/localghost)\ **Replies:** 4\ **Last updated:** [May 28, 2018, 11:59am UTC](https://discuss.elastic.co/t/docker-metrics-retrieval-efficiency/132578 "2018-05-28T11:59:37Z")
I have set up monitoring Docker containers with Metricbeat and after a couple of days I have spotted suspicious regular peaks in connections to Docker's unix socket. Netstat pointed to Metricbeat. I have enabled debug mo… --- ## [If filebeat will start and kafka/logstash stop](https://discuss.elastic.co/t/if-filebeat-will-start-and-kafka-logstash-stop/133516)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 11:25am UTC](https://discuss.elastic.co/t/if-filebeat-will-start-and-kafka-logstash-stop/133516 "2018-05-28T11:25:58Z")
If filebeat running on application server and kafka/logstash will stop working , what will happen in that case ? logs data will come to kafka/logstash once we start logstash\\kafka process? or there will be data loss ? --- ## [Filebeat Pre-requisite & CPU , memory utilization](https://discuss.elastic.co/t/filebeat-pre-requisite-cpu-memory-utilization/133477)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 2\ **Last updated:** [May 28, 2018, 10:11am UTC](https://discuss.elastic.co/t/filebeat-pre-requisite-cpu-memory-utilization/133477 "2018-05-28T10:11:28Z")
Hi, I have some questions regarding filebeat. To deploy filebeat , we need to have java on same system ? How much memory & CPU Utilized by filebeat? If there is heavy log file, memory & CPU utlization also increased ?… --- ## [Filebeat registry file on Window 7 (not found)](https://discuss.elastic.co/t/filebeat-registry-file-on-window-7-not-found/133511)
**Author:** [@kuba72](https://discuss.elastic.co/u/kuba72)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 10:02am UTC](https://discuss.elastic.co/t/filebeat-registry-file-on-window-7-not-found/133511 "2018-05-28T10:02:28Z")
Hi I'm running filebeat on windows sending data to logstash, but I cannot find the registry file from filebeat. Filebeat is installed under C:\\Bitnami\\filebeat. Can you tell me where that file should be located? Thank… --- ## [Elastic as a Nessus replacement?](https://discuss.elastic.co/t/elastic-as-a-nessus-replacement/133353)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 10:01am UTC](https://discuss.elastic.co/t/elastic-as-a-nessus-replacement/133353 "2018-05-28T10:01:26Z")
Just thinking out loud here.... Is it possible to leverage filebeat to ingest installed rpms on any given hosts and use elastic as a means to see what vulnerabilities we have in our environment? I'm just about positive … --- ## [How to fetch %cpu userspace using metricbeat modules?](https://discuss.elastic.co/t/how-to-fetch-cpu-userspace-using-metricbeat-modules/131853)
**Author:** [@vschakka](https://discuss.elastic.co/u/vschakka)\ **Replies:** 4\ **Last updated:** [May 28, 2018, 9:58am UTC](https://discuss.elastic.co/t/how-to-fetch-cpu-userspace-using-metricbeat-modules/131853 "2018-05-28T09:58:27Z")
Hi, I have metric beat configuration as below: metricbeat.modules: module: system metricsets: \[cpu\] cpu.metrics: \[percentages, normalized\_percentages\] enabled: true period: 20s processes: \['.\*'\] fields\_under\_ro… --- ## [Filebeat - How to tag multiple log files in kubernetes pod?](https://discuss.elastic.co/t/filebeat-how-to-tag-multiple-log-files-in-kubernetes-pod/133266)
**Author:** [@sivakr](https://discuss.elastic.co/u/sivakr)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 9:50am UTC](https://discuss.elastic.co/t/filebeat-how-to-tag-multiple-log-files-in-kubernetes-pod/133266 "2018-05-28T09:50:37Z")
I have a pod which writes multiple log files (in different format) like /var/log/custom1.log /var/log/custom2.log And the pod has label: payment Now how do I create a Filebeat DeamonSet which looks for pod with label… --- ## [Filebeat , Kafka Cluster and Zookeeper ensemble configuration with SASL authentication](https://discuss.elastic.co/t/filebeat-kafka-cluster-and-zookeeper-ensemble-configuration-with-sasl-authentication/133100)
**Author:** [@SJN8](https://discuss.elastic.co/u/SJN8)\ **Replies:** 2\ **Last updated:** [May 28, 2018, 9:22am UTC](https://discuss.elastic.co/t/filebeat-kafka-cluster-and-zookeeper-ensemble-configuration-with-sasl-authentication/133100 "2018-05-28T09:22:26Z")
Hi All, I have a working Filebeat, Kafka Cluster, and Zookeeper Ensemble but after integrating SASL authentication I am facing below exception, Filebeat:- 2018-05-23T11:58:13+02:00 INFO kafka message: \[client/me… --- ## [Send logs to 2 logstash servers simultaneously](https://discuss.elastic.co/t/send-logs-to-2-logstash-servers-simultaneously/133249)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 5\ **Last updated:** [May 28, 2018, 9:05am UTC](https://discuss.elastic.co/t/send-logs-to-2-logstash-servers-simultaneously/133249 "2018-05-28T09:05:17Z")
My requirement is to configure filebeat output as two logstash servers and I need to send logs to defined 2 servers simultaneously. It is not load balance scenario. Both logstash servers should received same data. I do … --- ## [Filebeats autodiscover : Segmentation violation](https://discuss.elastic.co/t/filebeats-autodiscover-segmentation-violation/133342)
**Author:** [@Theo\_Delahayes](https://discuss.elastic.co/u/Theo_Delahayes)\ **Replies:** 2\ **Last updated:** [May 28, 2018, 7:47am UTC](https://discuss.elastic.co/t/filebeats-autodiscover-segmentation-violation/133342 "2018-05-28T07:47:14Z")
Hi, I've tried the autodiscovery feature for Docker and i keep getting a segmentation violation error each time that i try launching filebeats ( with args -e -d "\*" ) : using filebeats 6.2.4 Here are the logs : 018-05… --- ## [Translate Filter Destination](https://discuss.elastic.co/t/translate-filter-destination/133406)
**Author:** [@empfangsfehler](https://discuss.elastic.co/u/empfangsfehler)\ **Replies:** 8\ **Last updated:** [May 27, 2018, 3:19pm UTC](https://discuss.elastic.co/t/translate-filter-destination/133406 "2018-05-27T15:19:55Z")
Hi there, i would like to store my translated field as "dhcp.EventName" but it seems not to work, the field is never created or filled. I haven't found anything in the documentation about this. I tried the following co… [Previous page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=447) [Next page](https://discuss.elastic.co/c/elastic-stack/beats/28.md?page=449)